In summary, the most important issues here are:

• The Aggregate’s main task is to protect invariants (business rules, the boundary of immediate consistency)
• In a multi-threaded environment, when multiple threads are running simultaneously on the same Aggregate, a business rule may be broken
• A way to solve concurrency conflicts is to use Pessimistic or Optimistic concurrency techniques
• Pessimistic Concurrency involves the use of a database transaction and a locking mechanism. In this way, requests are processed one after the other, so basically concurrency is lost and it can lead to deadlocks.
• Optimistic Concurrency technique is based on versioning database records and checking whether the previously loaded version has not been changed by another thread.
• Entity Framework Core supports Optimistic Concurrency. Pessimistic Concurrency is not supported
• The Aggregate must always be treated and versioned as a single unit
• Domain events are an indicator, that state was changed so Aggregate version should be changed as well 

public class AggregateRootBase : Entity, IAggregateRoot
{
    private int _versionId;

    public void IncreaseVersion()
    {
        _versionId++;
    }
}

internal sealed class OrderEntityTypeConfiguration : IEntityTypeConfiguration<Order>
{
    public void Configure(EntityTypeBuilder<Order> builder)
    {
        builder.Property("_versionId").HasColumnName("VersionId").IsConcurrencyToken();
 
        //...
    }
}

var order = await _ordersContext.Orders.FindAsync(orderId);
order.AddOrderLine(request.ProductCode); 
var domainEvents = DomainEventsHelper.GetAllDomainEvents(order);
if (domainEvents.Any())
{
    order.IncreaseVersion();
}
await _ordersContext.SaveChangesAsync();

public static class SystemTime
{
    public static Func<DateTime> Now = () => DateTime.Now;
}

public interface ISystemClock
{
    DateTime Now { get; }
}

Impersonation Process

Impersonation is when an admin user is logged in with the same privileges as a user, but without knowing their password or other credentials. I’ve used this in couple applications and it was invaluable for support cases and debugging user permissions. 

[Authorize(Roles = "Admin")] // <-- Make sure only admins can access this 
public async Task<IActionResult> ImpersonateUser(String userId)
{
    var currentUserId = User.GetUserId();

    var impersonatedUser = await _userManager.FindByIdAsync(userId);

    var userPrincipal = await _signInManager.CreateUserPrincipalAsync(impersonatedUser);

    userPrincipal.Identities.First().AddClaim(new Claim("OriginalUserId", currentUserId));
    userPrincipal.Identities.First().AddClaim(new Claim("IsImpersonating", "true"));

    // sign out the current user
    await _signInManager.SignOutAsync();

    await HttpContext.Authentication.SignInAsync(cookieOptions.ApplicationCookieAuthenticationScheme, userPrincipal);

    return RedirectToAction("Index", "Home");
}